A fork of a private repo is private. When you make the original repo public, the fork is still a private repo, but the commits can now be accessed by hash.
Is it hard to brute force? If so, it is still something that can be sniffed, though you can't unlock the car without first recording a genuine button press.
Easylist should serve the Indian browser (based on user-agent) with a giant file (expensive), a corrupt file, or some response which causes the app the crash. If the browser crashes on every startup due to a malicious response from the Easylist server, users will likely delete it.
I don't believe the kids behind this Twitter account. I don't know why they're doing it exactly, probably some form of clout or to scam buyers on darknet marketplaces, but I know that many of their screenshots are faked. I know people at one of the companies they claimed to have hacked - they posted a Ruby on Rails directory structure as proof of hacking them but the company does not have Ruby code. So I would not trust any of their tweets.
Trying to think how to anonymise datetimes hurts my head. You might want to randomise the date of an event. But you also need this random date to be consistent with respect to both the current time and the order of other related rows in the database.
Also, if you don't have a public access block in place, a private bucket can contain public files! Even if you can't list the files in the bucket, there are tools which try to guess common file names from guessed bucket names e.g. sega-secret-sauce.s3.amazonaws.com/.env - if someone uploaded a file there without setting the ACL correctly there could be an unprotected file in the private bucket.
By temporarily defacing the Sega website and modifying files I think they have crossed the line. Enumerating what access they have, rooting through S3 and reporting it is OK, but by messing around like script kiddies they can no longer claim good faith. Publicising that you've illegally defaced the website is a little silly. Of course, Sega should not have got themselves so completely owned. Sega deserved to be punished, but these VPN twits have clearly committed a crime and Sega should maybe sue their company.
So if they didn't create a new user account and IAM account what would you see? If they just used the remote shell and the installed aws cli e.g. `aws s3 ls` would you be able to detect it?
This article is an ad.
I had a personal project that I got bored with so I let the domain expire. Then I got emails from former users saying that the domain was now hosting malware. So yeah I would like it for all the old links to the site to somehow know that the owner has changed. Not sure what a reasonable solution would look like though.
What is a good way to communicate audio information. Listening to audio doesn't necessarily explain how the sound was made (well it does kind of), whereas seeing a word in IPA makes it easy to reproduce (for people familiar with IPA) and compare.
English writing is not a good phonetic system for representing speech even for the English language: IMO a 1-to-1 mapping between pronunciation and spelling should be the goal.
You might want to explain how to pronounce the word in a British or Australian accent or compare it to how a word was pronounced 200 years ago. In that case you can use a phonetic alphabet to show the difference.
The idea is to have a writing system which can be used to accurately record all possible sounds. It's helpful for learning languages with bad alphabets such as English (https://www.teachingenglish.org.uk/article/teaching-pronunci...), for describing accents and for comparing languages and linguistics work.
PS: I don't know IPA so I'm probably wrong about everything.
The UK is also "literally an island", though 4 times as big as Taiwan. Taiwan banned flights from China early on, and now only allows entry to residents and those on business. The UK has still not stopped international travel. Quarantine on arrival in the UK is weak and unenforced, compared to Taiwan where the only way out of the airport is in a quarantine taxi to an approved place and you get tracked by your phone for 2 weeks. By consistently refusing to take timely action, and refusing to take things seriously, the UK forefeited its island advantage.
Swiss tech companies find that there isn't enough talent within Switzerland unless they are focusing purely on the Swiss market. Cost of living is higher than London in somewhere like Geneva.
For growing US tech companies, what is the main reason why they want to open a tech office in Europe? If it's just regulatory / business / tax stuff, there's no need to employ developers: it could just be business & legal side. If it's access to talent then London is still great. Perhaps that will decline as it won't be as easy to bring EU citizens over to work there.
I know that the Silicon Valley salaries can be several times higher than in London, but for some Europeans it just doesn't seem super attractive to live and work in the US.
Have you tried knockd https://linux.die.net/man/1/knockd ? You send a special sequence of "knocks" to the server (packets to different ports) and it executes a command such as allowing your IP for a time period. No JWTs.
Thanks that's really interesting, as I see from your reports you could call /json/list with rebinding to get the guid. For the past 2 years it now validates the Host header.
Node debug mode runs a websocket, but the address is something like ws://0.0.0.0:9229/1cda98c5-9ae8-4f9a-805a-f36d0a8cdbe8 - without the correct guid at the end, you can't open the websocket and communicate. You can only detect the port being open by timing.
You can only make a websockets request. The javascript call will fail if either the port is closed, or the port is open but doesn't act like a websockets server. So you can tell if a port is open by the time it takes for the connection to fail. If it's actually a websockets server you hit, then you might get a useable bidirectional communication channel to it.
The results on https://panopticlick.eff.org seem much more accurate. Probably since Panopticlick by EFF is more well-known and therefore has better data.